← All changes | core/admin/page-settings-listing.php +76 -50 2.1.7 → 2.1.21 View file →

		@@ -67,59 +67,67 @@
67	67	}
68	68
69	69
70	70	public function content() {
71		-
	71	+
	72	+ if ( ! $this->can_manage_listing_template() ) {
	73	+ wp_die(
	74	+ esc_html__( 'Sorry, you are not allowed to manage the Booking Manager listing template.', 'booking-manager' )
	75	+ , esc_html__( 'Forbidden', 'booking-manager' )
	76	+ , array( 'response' => 403 )
	77	+ );
	78	+ }
	79	+
72	80	do_action( 'wpbm_hook_settings_page_header', array( 'page' => $this->in_page() ) ); // Define Notices Section and show some static messages, if needed.
73		-
74		- ////////////////////////////////////////////////////////////////////////
	81	+
	82	+ ////////////////////////////////////////////////////////////////////////
75	83	// Submit /////////////////////////////////////////////////////////////
76		-
	84	+
77	85	$submit_form_name = 'wpbm_form_listing'; // Define form name
78		-
	86	+
79	87	if ( isset( $_POST['is_form_sbmitted_'. $submit_form_name ] ) ) {
80	88
81	89	// Nonce checking {Return false if invalid, 1 if generated between, 0-12 hours ago, 2 if generated between 12-24 hours ago. }
82	90	$nonce_gen_time = check_admin_referer( 'wpbm_settings_page_' . $submit_form_name ); // Its stop show anything on submiting, if its not refear to the original page
83	91
84		- // Save Changes
	92	+ // Save Changes
85	93	$this->update();
86		- }
	94	+ }
87	95
88	96	////////////////////////////////////////////////////////////////////////
89		- // Get Data from DB ////////////////////////////////////////////////////
90		- $data_list_tmpl = get_wpbm_option( 'wpbm_listing_template' );
	97	+ // Get Data from DB ////////////////////////////////////////////////////
	98	+ $data_list_tmpl = get_wpbm_option( 'wpbm_listing_template' );
91	99	//$data_list_tmpl = wpbm_nl_after_br( $data_list_tmpl );
92		-
93		-
	100	+
	101	+
94	102	////////////////////////////////////////////////////////////////////////
95	103	// Toolbar /////////////////////////////////////////////////////////////
96	104	wpbm_bs_toolbar_sub_html_container_start();
97	105
98		- ?><span class="wpdevelop"><div class="visibility_container clearfix-height" style="display:block;"><?php
	106	+ ?><span class="wpdevelop0"><div class="visibility_container clearfix-height" style="display:block;"><?php
99	107
100	108	wpbm_js_for_items_page(); // JavaScript functions
101		-
	109	+
102	110	$this->toolbar_reset_to_default(); // Reset to Default Forms
103		-
	111	+
104	112	$save_button = array( 'title' => __('Save Changes', 'booking-manager'), 'form' => $submit_form_name );
105		- $this->toolbar_save_button( $save_button ); // Save Button
106		-
	113	+ $this->toolbar_save_button( $save_button ); // Save Button
	114	+
107	115	?></div></span><?php
108		-
	116	+
109	117	wpbm_bs_toolbar_sub_html_container_end();
110		-
	118	+
111	119	?><div class="clear"></div><?php
112		-
	120	+
113	121	if ( 0 ) {
114	122	// Scroll links ////////////////////////////////////////////////////////
115	123	?>
116	124	<div class="wpdvlp-sub-tabs" style="background:none;border:none;box-shadow: none;padding:0;"><span class="nav-tabs" style="text-align:right;">
117		- <a href="javascript:void(0);" onclick="javascript:wpbm_scroll_to('#wpbm_settings_listing_metabox' );" original-title="" class="nav-tab go-to-link"><span><?php echo ucwords( __('Listing', 'booking-manager') ); ?></span></a>
	125	+ <a href="javascript:void(0);" onclick="javascript:wpbm_scroll_to('#wpbm_settings_listing_metabox' );" original-title="" class="nav-tab go-to-link"><span><?php echo ucwords( __('Listing', 'booking-manager') ); ?></span></a>
118	126	</span></div>
119	127	<?php
120	128	}
121		-
	129	+
122	130	////////////////////////////////////////////////////////////////////////
123	131	// Content ////////////////////////////////////////////////////////////
124	132	?>
125	133	<div class="clear" style="margin-bottom:10px;"></div>
		@@ -124,58 +132,76 @@
124	132	?>
125	133	<div class="clear" style="margin-bottom:10px;"></div>
126	134	<span class="metabox-holder">
127	135	<form name="<?php echo $submit_form_name; ?>" id="<?php echo $submit_form_name; ?>" action="" method="post">
128		- <?php
129		- // N o n c e field, and key for checking S u b m i t
	136	+ <?php
	137	+ // N o n c e field, and key for checking S u b m i t
130	138	wp_nonce_field( 'wpbm_settings_page_' . $submit_form_name );
131		- ?><input type="hidden" name="is_form_sbmitted_<?php echo $submit_form_name; ?>" id="is_form_sbmitted_<?php echo $submit_form_name; ?>" value="1" /><?php
132		-
133		- ?><input type="hidden" name="reset_to_default_form" id="reset_to_default_form" value="" /><?php
134		-
	139	+ ?><input type="hidden" name="is_form_sbmitted_<?php echo $submit_form_name; ?>" id="is_form_sbmitted_<?php echo $submit_form_name; ?>" value="1" /><?php
	140	+
	141	+ ?><input type="hidden" name="reset_to_default_form" id="reset_to_default_form" value="" /><?php
	142	+
135	143	?><div class="wpbm_settings_row wpbm_settings_row_left"><?php
136		-
	144	+
137	145	wpbm_open_meta_box_section( 'wpbm_settings_listing', __('Event template - row for event listing', 'booking-manager') );
138		-
139		- $this->show_listing_template( $data_list_tmpl );
140		-
	146	+
	147	+ $this->show_listing_template( $data_list_tmpl );
	148	+
141	149	wpbm_close_meta_box_section();
142	150	?>
143		- </div>
144		- <div class="wpbm_settings_row wpbm_settings_row_right"><?php
145		-
	151	+ </div>
	152	+ <div class="wpbm_settings_row wpbm_settings_row_right"><?php
	153	+
146	154	wpbm_open_meta_box_section( 'wpbm_settings_listing_help', __('Help', 'booking-manager') );
147		-
148		- $this->show_content_data_form_help();
149		-
	155	+
	156	+ $this->show_content_data_form_help();
	157	+
150	158	wpbm_close_meta_box_section();
151	159	?>
152	160	</div>
153	161	<div class="clear"></div>
154		- <input type="submit" value="<?php _e('Save Changes','booking-manager'); ?>" class="button button-primary wpbm_submit_button" />
	162	+ <input type="submit" value="<?php _e('Save Changes','booking-manager'); ?>" class="button button-primary wpbm_submit_button" />
155	163	</form>
156	164	</span>
157		- <?php
158		-
	165	+ <?php
	166	+
159	167	$this->css();
160	168	$this->js();
161		-
	169	+
162	170	do_action( 'wpbm_hook_settings_page_footer', 'listing_template' );
163		-
	171	+
164	172	}
165	173
166		-
167		- /** Save Chanages */
	174	+
	175	+ /** Save Chanages */
168	176	public function update() {
169		-
170		- // We can not use here such code:
171		- // WPBM_Settings_API::validate_textarea_post_static( 'listing_template' );
172		- // becuse its will remove also JavaScript, which possible to use for wizard form or in some other cases.
173		- $data_list_tmpl = trim( stripslashes( $_POST['listing_template'] ) );
	177	+
	178	+ if ( ! $this->can_manage_listing_template() ) {
	179	+ wp_die(
	180	+ esc_html__( 'Sorry, you are not allowed to manage the Booking Manager listing template.', 'booking-manager' )
	181	+ , esc_html__( 'Forbidden', 'booking-manager' )
	182	+ , array( 'response' => 403 )
	183	+ );
	184	+ }
	185	+
	186	+ $data_list_tmpl = isset( $_POST['listing_template'] ) ? trim( wp_unslash( $_POST['listing_template'] ) ) : '';
	187	+ $data_list_tmpl = wpbm_sanitize_listing_template( $data_list_tmpl );
174	188	update_wpbm_option( 'wpbm_listing_template' , $data_list_tmpl );
175	189
176		- wpbm_show_changes_saved_message();
	190	+ wpbm_show_changes_saved_message();
177	191	}
	192	+
	193	+
	194	+ /**
	195	+ * Listing template is a global frontend template, so managing it requires
	196	+ * administrator-level options access rather than the general plugin menu role.
	197	+ *
	198	+ * @return bool
	199	+ */
	200	+ private function can_manage_listing_template() {
	201	+
	202	+ return current_user_can( 'manage_options' );
	203	+ }
178	204
179	205
180	206	// <editor-fold defaultstate="collapsed" desc=" CSS / JS " >
181	207